KYC in Somalia: A 2026 guide for fintechs

KYC in Somalia is not the same problem it was three years ago. A national biometric ID rollout, a new central-bank framework, and the arrival of mobile-money operators that handle remittance volumes larger than the formal banking system have all reshaped what "know your customer" means on the ground in Mogadishu, Hargeisa, Garowe and Kismayo.

This is a practical guide for fintechs building or expanding into Somalia in 2026. It covers what regulators actually require, which IDs to accept, the realities of mobile-money onboarding, and the patterns we see fail when teams try to ship a generic global KYC stack.

Who regulates KYC in Somalia, and what they actually require

KYC in Somalia is governed primarily by the Central Bank of Somalia (CBS) through its AML/CFT framework and a series of circulars issued since 2022. In Somaliland, the Bank of Somaliland (BoS) plays the equivalent role. Telecoms KYC is governed separately by the National Communications Authority (NCA), which issued the SIM-registration directive that anyone touching mobile money has to comply with.

The requirements are pragmatic rather than maximalist. For a standard retail account or wallet, the regulated entity must collect and verify:

Full legal name, matching the customer's primary identity document.
Date of birth.
National identity number (where the customer has one) or passport number.
Photograph captured at onboarding - a selfie is sufficient if you can prove a live capture.
Physical address - usually a neighbourhood (degmo) and city. Street addresses are not universally available.
Phone number, verified by OTP.
Source of funds attestation for accounts over modest thresholds.

For enhanced due diligence on higher-risk customers (PEPs, large transfers, cross-border remittance receivers), additional documents and sanctions screening are required. See our deeper AML guide for East African fintechs for the screening side of this.

The identity document landscape

Somalia is in the middle of a transition from paper-based identification to a national biometric ID. As a fintech, you cannot assume every customer has the new card yet, and you cannot refuse customers who only have older proof. A workable acceptance list looks like this:

National identity card

The flagship document. Issued by the National Identification and Registration Authority (NIRA), it carries:

A 10-digit national ID number.
A high-resolution portrait.
A machine-readable zone (MRZ) on the back conforming to ICAO 9303 standard for ID-1 cards.
Biometric data (fingerprints and iris) registered against the central NIRA database, with a verification API available to licensed entities.

If your customer has a NIRA card, this is your primary credential. You can OCR the card, parse the MRZ to validate the check digits, and - if you're licensed - query NIRA's ePIN endpoint to confirm the record is active. We unpack the document itself in How to verify a Somali national ID.

Somali passport

The post-2014 e-passport conforms to ICAO standards and carries an NFC chip. The MRZ on page two follows the standard TD3 format. The chip can be read by an NFC-capable phone, and the data-group signatures verified against the Somali CSCA certificate (available through the ICAO PKD).

Passport verification is the gold standard when the customer has one, but issuance is uneven outside major cities.

Driver's licence

Issued regionally - Banadir, Puntland, Somaliland and Jubaland each run their own driver licensing. There is no single standard. Layouts, security features and even the language printed on the card vary. For KYC purposes, a driver's licence is a useful secondary document but should not be treated as a primary credential.

Civil registry extract

A document issued by the mayor's office (Banadir Regional Administration in Mogadishu) attesting to a person's identity, parents' names and place of birth. Slow to obtain, but accepted by banks as a legal identity document for adults who have not yet been issued a NIRA card.

What about diaspora customers?

Many Somali fintech customers are diaspora - wage-earners in Minneapolis, Toronto, London, Stockholm, Nairobi or the Gulf, sending money home. Their KYC should run on the document of their country of residence (US drivers' licence, UK passport, Schengen ID card), supplemented by self-declared ties to Somalia. We dig into this flow in Remittance KYC for the Somali diaspora corridor.

The realities of capture in the field

Onboarding flows that work in Stockholm break in Somalia. Here are the practical issues you have to design for.

Connectivity is not uniform

A good 4G signal in the centre of Mogadishu does not mean a customer in Beletweyne or Galkayo has one. Build your capture flow to work on intermittent 3G, with image upload that resumes after a dropped connection. Compress aggressively on-device before upload - a 4 MB selfie at full resolution is a problem on a $40 Android phone.

Document quality is uneven

Cards get bent, laminated, photocopied, photographed under harsh light or against a busy background. Your OCR has to handle this gracefully. Pre-capture guidance - a card frame on screen, exposure feedback, real-time blur detection - produces dramatically better results than letting the user submit any photo. Aim for guided capture: every image arrives at your OCR pre-validated for focus and framing.

Names are not Latin-script-friendly

Somali names transliterate inconsistently. "Mohamed", "Mohammed", "Maxamed" and "Maxamuud" can all refer to the same person. Your name-matching logic has to use fuzzy matching, ideally with a transliteration table tuned for Somali (Maxamed → Mohamed, Xasan → Hassan, Cabdullaahi → Abdullahi). Generic Latin string-similarity will produce false negatives that frustrate customers and false positives that bypass screening.

Selfie capture in low light

Many onboardings happen in the evening or in shaded interiors. A selfie capture that demands daylight will fail. Use a model trained or fine-tuned on darker skin tones in mixed lighting. We cover the technical side in Face match accuracy across skin tones.

The mobile-money reality

Most Somali consumers transact in mobile money, not in cash and not through a bank. EVC Plus (Hormuud), Sahal (Somtel) and Zaad (Telesom) collectively move billions of dollars a month. They are, in effect, the rails.

This has two implications for KYC:

SIM-based identity is load-bearing. When the NCA issued the SIM-registration directive, telcos became de facto identity providers. A verified SIM is a useful KYC signal - but only if you can cryptographically tie the SIM to the customer in front of you, not just to the SIM that they're using right now.
Wallet-to-wallet onboarding is the path of least resistance. A new wallet can be opened in seconds, with KYC carried implicitly from the telco. This is a regulatory shortcut, not a compliance one - you still need to verify the underlying person if your service is independently licensed.

We unpack the operational reality in Mobile money onboarding in Somalia.

Where fintechs get it wrong

Three patterns we see repeatedly:

Treating Somalia as "Africa"

Pan-African KYC vendors typically cover Nigeria, Kenya, South Africa, and call it "Africa coverage." Somali documents are absent or shoehorned into a generic "rest of Africa" template that fails on document layout, MRZ standard, and name transliteration. Choose a vendor - or build a stack - that has actually seen a NIRA card and a Banadir driver's licence.

Hard-coding US-style address rules

A "house number, street, city, state, ZIP" address field is unfillable for most Somali customers. Their address is "Hodan district, Mogadishu" or "Berbera, Saaxil." Make city + neighbourhood mandatory; everything else optional.

Refusing customers without a NIRA card

The NIRA rollout is impressive but incomplete. A KYC flow that rejects anyone without a national ID will exclude a large minority of the population - especially older customers, IDPs, and people in rural districts. Build a multi-document acceptance flow with risk-tiered limits: lower wallet ceilings for civil-registry-only customers, full limits for NIRA card holders.

Ignoring data residency

Somali regulators are increasingly explicit that customer data should stay on-continent. Your S3 bucket in us-east-1 is a problem. We cover the architectural side in On-continent data residency for African fintechs.

A minimal viable KYC flow for a Somali fintech

If you're starting fresh, here is the shortest path from launch to a defensible KYC operation:

Document capture, with guided framing and on-device quality checks.
OCR for both NIRA cards and passports, with MRZ parsing and check-digit validation.
Selfie capture with liveness - passive liveness is enough for retail tiers; active liveness for higher-risk segments.
Face match between the document portrait and the selfie, with a 0.80 threshold for retail and 0.92 for enhanced due diligence.
Phone OTP binding the customer to a verified Somali mobile number.
Sanctions and PEP screening against OFAC, EU and UN lists at minimum; ideally also OpenSanctions.
Risk-tiered limits keyed off document grade - NIRA holders get full limits; civil-registry-only customers start lower and graduate after activity.
Audit log of every step, signed and immutable, so the central bank inspector can replay the decision two years from now.

Ogowkey is built specifically for this stack. One API key handles document OCR, biometric face match, liveness, AML screening, and the audit log - all with native Somali document templates and on-continent residency. Try the playground or read the docs for the API surface.

Closing thought

KYC in Somalia is solvable. The regulatory framework is workable, the document landscape is improving, and there is a real, growing market of customers who want fast, dignified, secure onboarding into the formal financial system. The teams that win here will be the ones that take the local detail seriously - the transliterations, the address conventions, the document variants - and stop treating Somalia as a footnote in a global vendor's coverage map.

If you're building in this space and want to compare notes, [get in touch](mailto:olow304@gmail.com?subject=Ogowkey%20 - %20KYC%20Somalia).